Email: 309177 Autolearn: 0 AvgScore: 3.85 AvgScanTime: 1.34 sec Spam: 90576 Autolearn: 0 AvgScore: 13.02 AvgScanTime: 1.42 sec Ham: 218601 Autolearn: 0 AvgScore: 0.06 AvgScanTime: 1.31 sec Time Spent Running SA: 115.32 hours Time Spent Processing Spam: 35.78 hours Time Spent Processing Ham: 79.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87353 86.67 96.44 82.62 2 RELAYCOUNTRY_US 76844 80.25 84.84 78.35 3 DKIM_SIGNED 73723 69.22 81.39 64.17 4 XM_DK_Pass 71008 67.71 78.40 63.28 5 DKIM_VALID 70153 67.14 77.45 62.87 6 XM_B_Unicode 68879 69.13 76.05 66.26 7 XM_B_SpammyWords 66001 52.95 72.87 44.70 8 DCC_CHECK 65422 48.26 72.23 38.33 9 XMListUnsubscribeExists 60375 49.13 66.66 41.87 10 DKIM_VALID_AU 57640 53.79 63.64 49.71 11 LOC_TINY_FONT_1 42890 31.25 47.35 24.58 12 XM_B_Unicode3 41573 43.91 45.90 43.08 13 HTML_FONT_LOW_CONTRAST 41384 37.98 45.69 34.78 14 BAYES_50 39431 51.79 43.53 55.21 15 XM_B_SpammyWords2 34414 25.57 37.99 20.42 16 XM_DK_Undo_02 33816 13.82 37.33 4.07 17 RCVD_IN_MSPIKE_H2 33540 33.02 37.03 31.36 18 BAYES_99 27487 10.89 30.35 2.83 19 FVGT_m_MULTI_ODD 26519 23.18 29.28 20.65 20 T_KAM_HTML_FONT_INVALID 25573 22.08 28.23 19.54 21 DCC_CHECK_NEGATIVE 24880 51.64 27.47 61.65 22 TR_XM_DKIM_Undo 23830 8.89 26.31 1.67 23 MIME_HTML_ONLY 23766 23.01 26.24 21.67 24 XMSubLong 23520 23.54 25.97 22.53 25 T_TM2_M_HEADER_IN_MSG 21933 25.18 24.22 25.58 26 TR_DCC_Bayes_99 21257 7.66 23.47 1.11 27 BAYES_999 21156 8.34 23.36 2.12 28 XM_Multi_Part_URI 19921 17.41 21.99 15.50 29 DKIM_VALID_EF 19046 24.25 21.03 25.59 30 XM_B_Unsub 14166 12.57 15.64 11.29 31 XM_Evil_Numbers_Gen 13986 12.67 15.44 11.52 32 TR_XM_BayesUnsub 13593 8.66 15.01 6.02 33 UNPARSEABLE_RELAY 13501 14.25 14.91 13.98 34 TR_XM_DK_Unsub 13299 11.65 14.68 10.40 35 XM_B_SpammyWords3 13264 7.21 14.64 4.13 36 TR_MAX_INTL_RELAY 13218 7.73 14.59 4.89 37 RELAYCOUNTRY_META 13104 6.71 14.47 3.49 38 LotsOfNums_01 12700 11.79 14.02 10.87 39 TR_XM_SpammyWords2 11073 3.80 12.23 0.31 40 TM2_M_VERY_LONG_WORD 10264 9.77 11.33 9.12 41 BOTNET_IPINHOSTNAME 9959 5.60 11.00 3.36 42 TR_XM_SpammyRelay 9726 4.54 10.74 1.97 43 ANY_BOUNCE_MESSAGE 9486 11.32 10.47 11.68 44 BOUNCE_MESSAGE 9486 11.32 10.47 11.68 45 XM_Body_Dirty_Words 8824 4.30 9.74 2.04 46 BOTNET 8195 3.51 9.05 1.21 47 BAYES_80 8164 4.79 9.01 3.05 48 SHORT_URI_2 7651 5.05 8.45 3.65 49 SHORT_URI_3 7649 6.20 8.44 5.27 50 TR_XM_UnparsRelay 7445 3.45 8.22 1.47 51 FSL_BULK_SIG 7395 8.22 8.16 8.25 52 HTML_IMAGE_RATIO_02 7319 5.95 8.08 5.07 53 BAYES_60 7192 8.27 7.94 8.41 54 HTML_IMAGE_ONLY_32 6889 4.32 7.61 2.96 55 XM_B_Phish_Phrases 6525 5.10 7.20 4.23 56 LOTS_OF_MONEY 6254 7.00 6.90 7.03 57 RCVD_IN_BL_SPAMCOP_NET 6178 2.30 6.82 0.43 58 TooManyTo_001 5825 8.49 6.43 9.34 59 UNTRUSTED_Relay 5807 2.92 6.41 1.48 60 TR_XM_SpammyWords4 5802 6.14 6.41 6.03 61 RELAYCOUNTRY_CA 5666 2.88 6.26 1.48 62 MPART_ALT_DIFF 5435 4.23 6.00 3.50 63 XM_UncommonTLD01 5422 8.10 5.99 8.98 64 TR_XM_SPAMCOP 5279 1.90 5.83 0.27 65 KHOP_HELO_FCRDNS 5139 5.36 5.67 5.23 66 XMSubMetaSx_00 4859 3.78 5.36 3.13 67 XM_H_Long_From01 4826 4.25 5.33 3.80 68 BAYES_95 4798 2.86 5.30 1.85 69 T_XMDrugObfuBody_14 4728 2.97 5.22 2.04 70 XM_H_GMP 4700 4.73 5.19 4.54 71 TR_XM_PhishingBody 4228 2.34 4.67 1.38 72 XMSexyCombo_05 3798 1.74 4.19 0.72 73 DKIM_ADSP_NXDOMAIN 3776 1.47 4.17 0.35 74 XMStrtUSub 3677 4.66 4.06 4.91 75 XM_CamelCaseFrm001 3588 2.53 3.96 1.94 76 DKIM_INVALID 3570 2.08 3.94 1.30 77 XM_B_PhoneNumber 3508 9.49 3.87 11.82 78 HTML_IMAGE_RATIO_04 3432 3.47 3.79 3.34 79 RCVD_IN_VALIDITY_RPBL 3308 1.12 3.65 0.06 80 XM_B_SpammyTLD 3247 7.43 3.58 9.02 81 HTML_IMAGE_RATIO_06 3195 2.92 3.53 2.66 82 MIME_HTML_MOSTLY 3151 2.27 3.48 1.77 83 MIME_HTML_ONLY_MULTI 3103 2.49 3.43 2.10 84 XM_UB50 3099 1.60 3.42 0.84 85 XM_B_Investor 3072 1.63 3.39 0.90 86 RCVD_IN_VALIDITY_SAFE 3060 5.28 3.38 6.07 87 RCVD_IN_VALIDITY_CERTIFIED 2686 4.65 2.97 5.34 88 TR_XM_SpammyWords5 2665 2.05 2.94 1.68 89 FROM_EXCESS_BASE64 2577 1.87 2.85 1.46 90 XMBody_17 2575 1.27 2.84 0.62 91 TM2_M_URI_OPT_OUT 2524 3.23 2.79 3.42 92 NO_DNS_FOR_FROM 2471 1.06 2.73 0.37 93 TR_XM_MaxWHORU 2461 1.01 2.72 0.31 94 XMNumbers 2443 2.91 2.70 3.00 95 HTML_IMAGE_RATIO_08 2326 2.39 2.57 2.32 96 XM_SPF_SoftFail 2235 2.56 2.47 2.60 97 T_XMHurry_00 2225 1.13 2.46 0.59 98 XMBrknScrpt_02 2224 1.31 2.46 0.84 99 DIET_1 2219 1.14 2.45 0.59 100 RCVD_IN_MSPIKE_H3 2189 3.37 2.42 3.77 101 RCVD_IN_MSPIKE_WL 2189 3.37 2.42 3.77 102 TR_XM_NoHeaderRelay 2127 0.87 2.35 0.26 103 XMDiploma_00 2082 1.43 2.30 1.07 104 XM_URI_RBL 2068 0.94 2.28 0.38 105 XM_OfRef6 2065 1.08 2.28 0.59 106 RELAYCOUNTRY_AU 2000 1.11 2.21 0.66 107 SpammyFromTLD_01 1961 3.64 2.17 4.26 108 TR_XM_PHPDW 1950 0.74 2.15 0.15 109 TR_XM_PHPForged 1878 0.71 2.07 0.15 110 TR_XM_FormFill2 1867 0.71 2.06 0.15 111 BOTNET_NORDNS 1857 0.61 2.05 0.01 112 T_TooManySym_01 1845 4.45 2.04 5.45 113 XM_H_PHPOS 1841 0.69 2.03 0.14 114 T_XMDrugObfuBody_08 1818 3.97 2.01 4.78 115 XM_B_SpammyWords4 1807 0.93 2.00 0.49 116 USER_IN_DEF_DKIM_WL 1796 10.55 1.98 14.10 117 URIBL_CSS 1771 0.60 1.96 0.04 118 URIBL_CSS_A 1771 0.60 1.96 0.04 119 XMStockSpam_06 1769 1.45 1.95 1.25 120 SH_BODYURI_REVERSE_CSS 1766 0.60 1.95 0.04 121 XM_B_REG_HTML 1727 0.70 1.91 0.21 122 SUBJ_ALL_CAPS 1657 1.36 1.83 1.17 123 THIS_AD 1618 0.74 1.79 0.30 124 XM_B_COPY_HTML 1616 1.42 1.78 1.27 125 HTML_MIME_NO_HTML_TAG 1582 2.10 1.75 2.24 126 NORDNS_LOW_CONTRAST 1557 0.52 1.72 0.02 127 XMPhish30 1525 0.96 1.68 0.66 128 MAILING_LIST_MULTI 1508 1.57 1.66 1.53 129 SHOPIFY_IMG_NOT_RCVD_SFY 1463 0.68 1.62 0.29 130 BAYES_40 1443 7.36 1.59 9.75 131 XMBounce_01 1439 0.47 1.59 0.01 132 T_XMDrugObfuBody_00 1408 0.64 1.55 0.26 133 MIME_QP_LONG_LINE 1375 3.29 1.52 4.02 134 T_FILL_THIS_FORM_SHORT 1350 0.77 1.49 0.47 135 XM_B_URI_Unicode 1339 1.63 1.48 1.70 136 ALL_TRUSTED 1325 13.44 1.46 18.41 137 SUSP_UTF8_WORD_SUBJ 1295 0.44 1.43 0.04 138 T_STY_INVIS_DIRECT 1292 0.81 1.43 0.55 139 XM_SendGrid 1279 1.30 1.41 1.26 140 SpammyFromTLD_02 1278 0.53 1.41 0.17 141 HTML_TAG_BALANCE_BODY 1261 0.90 1.39 0.70 142 XMBody_78 1251 0.58 1.38 0.24 143 XMSlimDrugH 1209 0.54 1.33 0.21 144 AC_BR_BONANZA 1185 0.48 1.31 0.13 145 XM_DK_Undo_01 1142 1.22 1.26 1.21 146 XM_B_Unsub2 1141 0.95 1.26 0.82 147 URI_HEX 1125 1.00 1.24 0.90 148 XMHTMLBadTable_001 1111 0.45 1.23 0.13 149 T_REMOTE_IMAGE 1110 2.49 1.23 3.02 150 TR_LOTS_OF_MONEY3 1097 0.50 1.21 0.20 151 XMSubMetaI_00 1080 0.89 1.19 0.76 152 TooManyTo_002 1067 3.73 1.18 4.79 153 TooManyTo_003 1009 0.76 1.11 0.62 154 XMReplyNow 997 0.48 1.10 0.22 155 TooManyTo_004 989 0.65 1.09 0.47 156 XM_DIRTYINTL 988 0.36 1.09 0.05 157 HTTPS_HTTP_MISMATCH 988 0.59 1.09 0.38 158 RDNS_DYNAMIC 981 0.49 1.08 0.25 159 TooManyTo_005 969 0.59 1.07 0.39 160 PDS_RDNS_DYNAMIC_FP 966 0.35 1.07 0.05 161 TR_XM_Base64_M1 966 0.74 1.07 0.60 162 TVD_RCVD_IP 965 0.83 1.07 0.74 163 XM_ProductURIs 955 0.55 1.05 0.35 164 TR_Symld_Words 943 0.94 1.04 0.90 165 XMPhish14 932 0.47 1.03 0.24 166 LongTLD 913 0.48 1.01 0.25 167 TR_XM_INV_DKIM 907 0.33 1.00 0.06 168 BAYES_20 905 2.99 1.00 3.81 169 XMSubMetaSxObfu_03 863 0.66 0.95 0.54 170 XMPhish08 848 0.42 0.94 0.21 171 RELAYCOUNTRY_CN 836 0.28 0.92 0.01 172 XMBdyGiftCard01 827 1.00 0.91 1.04 173 TR_XM_DK_SendGrid 819 0.92 0.90 0.93 174 XM_HighProb1 807 0.27 0.89 0.01 175 MPART_ALT_DIFF_COUNT 792 0.58 0.87 0.46 176 XMGenDplmaNmb 791 0.52 0.87 0.37 177 XM_H_PHPMailer 787 0.58 0.87 0.46 178 HELO_DYNAMIC_SPLIT_IP 784 0.26 0.87 0.02 179 XM_H_Long_From02 779 1.22 0.86 1.37 180 XM_B_Phish66 776 0.41 0.86 0.23 181 XM_UB99 758 0.25 0.84 0.00 182 TR_Mismatch_TLD_01 742 0.37 0.82 0.18 183 DKIM_ADSP_CUSTOM_MED 739 0.68 0.82 0.62 184 XM_PDF 720 2.95 0.79 3.84 185 XMSubMetaD_03 719 0.55 0.79 0.45 186 URI_TRY_3LD 707 0.67 0.78 0.62 187 TR_XM_Base64_L1 705 0.30 0.78 0.10 188 RCVD_IN_PBL 691 0.48 0.76 0.36 189 PLING_QUERY 679 0.48 0.75 0.37 190 T_PDS_OTHER_BAD_TLD 671 0.36 0.74 0.20 191 HOSTED_IMG_MULTI_PUB_01 667 0.25 0.74 0.05 192 TR_XM_Base64_M2 667 0.29 0.74 0.10 193 T_MONEY_PERCENT 666 0.28 0.74 0.09 194 XM_B_SEO 666 0.36 0.74 0.20 195 TR_LOTS_OF_MONEY2 666 0.28 0.74 0.09 196 TR_XM_RelayPhish 660 0.24 0.73 0.03 197 XMClaimOffer 659 0.44 0.73 0.32 198 URI_NOVOWEL 653 3.21 0.72 4.24 199 XM_B_DNDMA 634 0.64 0.70 0.61 200 XM_UB60 627 0.22 0.69 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 180610 86.67 96.44 82.62 2 RELAYCOUNTRY_US 171283 80.25 84.84 78.35 3 XM_B_Unicode 144841 69.13 76.05 66.26 4 DKIM_SIGNED 140275 69.22 81.39 64.17 5 XM_DK_Pass 138340 67.71 78.40 63.28 6 DKIM_VALID 137429 67.14 77.45 62.87 7 DCC_CHECK_NEGATIVE 134765 51.64 27.47 61.65 8 BAYES_50 120688 51.79 43.53 55.21 9 DKIM_VALID_AU 108662 53.79 63.64 49.71 10 XM_B_SpammyWords 97709 52.95 72.87 44.70 11 XM_B_Unicode3 94173 43.91 45.90 43.08 12 XMListUnsubscribeExists 91533 49.13 66.66 41.87 13 DCC_CHECK 83786 48.26 72.23 38.33 14 HTML_FONT_LOW_CONTRAST 76030 37.98 45.69 34.78 15 RCVD_IN_MSPIKE_H2 68560 33.02 37.03 31.36 16 DKIM_VALID_EF 55934 24.25 21.03 25.59 17 T_TM2_M_HEADER_IN_MSG 55914 25.18 24.22 25.58 18 LOC_TINY_FONT_1 53728 31.25 47.35 24.58 19 XMSubLong 49254 23.54 25.97 22.53 20 MIME_HTML_ONLY 47363 23.01 26.24 21.67 21 FVGT_m_MULTI_ODD 45148 23.18 29.28 20.65 22 XM_B_SpammyWords2 44649 25.57 37.99 20.42 23 T_KAM_HTML_FONT_INVALID 42708 22.08 28.23 19.54 24 ALL_TRUSTED 40237 13.44 1.46 18.41 25 XM_Multi_Part_URI 33893 17.41 21.99 15.50 26 USER_IN_DEF_DKIM_WL 30832 10.55 1.98 14.10 27 UNPARSEABLE_RELAY 30559 14.25 14.91 13.98 28 BAYES_00 27448 9.00 0.41 12.56 29 XM_B_PhoneNumber 25840 9.49 3.87 11.82 30 ANY_BOUNCE_MESSAGE 25524 11.32 10.47 11.68 31 BOUNCE_MESSAGE 25524 11.32 10.47 11.68 32 XM_Evil_Numbers_Gen 25175 12.67 15.44 11.52 33 XM_B_Unsub 24685 12.57 15.64 11.29 34 LotsOfNums_01 23754 11.79 14.02 10.87 35 XM_DKIMWhitelistDomains 23410 7.58 0.03 10.71 36 TR_XM_DK_Unsub 22733 11.65 14.68 10.40 37 BAYES_40 21320 7.36 1.59 9.75 38 TooManyTo_001 20416 8.49 6.43 9.34 39 TM2_M_VERY_LONG_WORD 19942 9.77 11.33 9.12 40 XM_B_SpammyTLD 19724 7.43 3.58 9.02 41 XM_UncommonTLD01 19634 8.10 5.99 8.98 42 BAYES_60 18383 8.27 7.94 8.41 43 FSL_BULK_SIG 18026 8.22 8.16 8.25 44 TR_XM_DK_Bayes 16073 5.30 0.36 7.35 45 TR_XM_DK_Bayes1 15997 5.28 0.36 7.32 46 LOTS_OF_MONEY 15376 7.00 6.90 7.03 47 RCVD_IN_VALIDITY_SAFE 13280 5.28 3.38 6.07 48 TR_XM_SpammyWords4 13178 6.14 6.41 6.03 49 TR_XM_BayesUnsub 13170 8.66 15.01 6.02 50 TR_XM_DK_Bayes2 13118 4.31 0.23 6.00 51 T_TooManySym_01 11924 4.45 2.04 5.45 52 RCVD_IN_VALIDITY_CERTIFIED 11676 4.65 2.97 5.34 53 SHORT_URI_3 11529 6.20 8.44 5.27 54 KHOP_HELO_FCRDNS 11424 5.36 5.67 5.23 55 HTML_IMAGE_RATIO_02 11090 5.95 8.08 5.07 56 XMStrtUSub 10730 4.66 4.06 4.91 57 TR_MAX_INTL_RELAY 10695 7.73 14.59 4.89 58 TooManyTo_002 10469 3.73 1.18 4.79 59 T_XMDrugObfuBody_08 10455 3.97 2.01 4.78 60 XM_H_GMP 9934 4.73 5.19 4.54 61 SpammyFromTLD_01 9308 3.64 2.17 4.26 62 URI_NOVOWEL 9260 3.21 0.72 4.24 63 XM_B_Phish_Phrases 9239 5.10 7.20 4.23 64 IN_ZIMBRA_NJ_WHITELIST 9050 2.94 0.05 4.14 65 XM_B_SpammyWords3 9034 7.21 14.64 4.13 66 MIME_CHARSET_FARAWAY 9012 3.07 0.53 4.12 67 XM_DK_Undo_02 8901 13.82 37.33 4.07 68 XM_B_FormFill 8866 2.87 0.02 4.06 69 MIME_QP_LONG_LINE 8791 3.29 1.52 4.02 70 XM_PDF 8392 2.95 0.79 3.84 71 BAYES_20 8332 2.99 1.00 3.81 72 XM_H_Long_From01 8311 4.25 5.33 3.80 73 RCVD_IN_MSPIKE_H3 8233 3.37 2.42 3.77 74 RCVD_IN_MSPIKE_WL 8233 3.37 2.42 3.77 75 CHARSET_FARAWAY_HEADER 8173 2.66 0.07 3.74 76 FUZZY_PHARMACY 8080 2.61 0.00 3.70 77 SHORT_URI_2 7977 5.05 8.45 3.65 78 MPART_ALT_DIFF 7646 4.23 6.00 3.50 79 RELAYCOUNTRY_META 7629 6.71 14.47 3.49 80 TM2_M_URI_OPT_OUT 7477 3.23 2.79 3.42 81 BOTNET_IPINHOSTNAME 7350 5.60 11.00 3.36 82 HTML_IMAGE_RATIO_04 7296 3.47 3.79 3.34 83 INVALID_MSGID 6945 2.34 0.33 3.18 84 XMSubMetaSx_00 6833 3.78 5.36 3.13 85 T_TooManySym_02 6798 2.36 0.57 3.11 86 BAYES_80 6658 4.79 9.01 3.05 87 T_REMOTE_IMAGE 6603 2.49 1.23 3.02 88 XMNumbers 6555 2.91 2.70 3.00 89 HTML_IMAGE_ONLY_32 6472 4.32 7.61 2.96 90 TO_MALFORMED 6334 2.05 0.00 2.90 91 BAYES_99 6191 10.89 30.35 2.83 92 HTML_IMAGE_RATIO_06 5823 2.92 3.53 2.66 93 XM_SPF_SoftFail 5676 2.56 2.47 2.60 94 BAYES_05 5544 1.96 0.58 2.54 95 HTML_IMAGE_RATIO_08 5072 2.39 2.57 2.32 96 HTML_MIME_NO_HTML_TAG 4899 2.10 1.75 2.24 97 RCVD_IN_IADB_LISTED 4756 1.69 0.52 2.18 98 BAYES_999 4641 8.34 23.36 2.12 99 MIME_HTML_ONLY_MULTI 4595 2.49 3.43 2.10 100 XM_Body_Dirty_Words 4462 4.30 9.74 2.04 101 T_XMDrugObfuBody_14 4456 2.97 5.22 2.04 102 TR_XM_SpammyRelay 4306 4.54 10.74 1.97 103 RCVD_IN_IADB_SPF 4247 1.50 0.44 1.94 104 XM_CamelCaseFrm001 4230 2.53 3.96 1.94 105 T_TVD_MIME_NO_HEADERS 4214 1.38 0.06 1.93 106 XM_B_SpammyTLD2 4102 1.38 0.18 1.88 107 BAYES_95 4037 2.86 5.30 1.85 108 MIME_HTML_MOSTLY 3864 2.27 3.48 1.77 109 RCVD_IN_IADB_SENDERID 3843 1.36 0.40 1.76 110 RCVD_IN_IADB_DK 3711 1.32 0.42 1.70 111 XM_B_URI_Unicode 3706 1.63 1.48 1.70 112 TR_XM_SpammyWords5 3683 2.05 2.94 1.68 113 TR_XM_DKIM_Undo 3658 8.89 26.31 1.67 114 TVD_SPACE_RATIO 3637 1.22 0.15 1.66 115 XM_TLDProd2 3530 1.21 0.23 1.61 116 MAILING_LIST_MULTI 3343 1.57 1.66 1.53 117 UNTRUSTED_Relay 3229 2.92 6.41 1.48 118 RELAYCOUNTRY_CA 3226 2.88 6.26 1.48 119 TR_XM_UnparsRelay 3219 3.45 8.22 1.47 120 FROM_EXCESS_BASE64 3197 1.87 2.85 1.46 121 IN_HORDE_ADDRESS_BOOK 3083 1.03 0.12 1.41 122 RCVD_IN_IADB_VOUCHED 3049 1.07 0.27 1.39 123 TR_XM_PhishingBody 3007 2.34 4.67 1.38 124 XM_H_Long_From02 2991 1.22 0.86 1.37 125 DKIM_INVALID 2846 2.08 3.94 1.30 126 XM_B_COPY_HTML 2767 1.42 1.78 1.27 127 XM_SendGrid 2751 1.30 1.41 1.26 128 XMStockSpam_06 2722 1.45 1.95 1.25 129 XMGappySubj_01 2651 0.91 0.18 1.21 130 XM_DK_Undo_01 2643 1.22 1.26 1.21 131 BOTNET 2642 3.51 9.05 1.21 132 SUBJ_ALL_CAPS 2559 1.36 1.83 1.17 133 TR_DCC_Bayes_99 2430 7.66 23.47 1.11 134 TM2_M_BODY_EMPTY 2398 0.90 0.43 1.10 135 XMDiploma_00 2340 1.43 2.30 1.07 136 T_TooManySym_03 2336 0.80 0.16 1.07 137 XMBdyGiftCard01 2280 1.00 0.91 1.04 138 RCVD_IN_IADB_OPTIN 2256 0.78 0.16 1.03 139 XMGappySubj_02 2252 0.74 0.03 1.03 140 XMLngstWrd_00 2133 0.79 0.35 0.98 141 GMD_PDF_EMPTY_BODY 2120 0.80 0.40 0.97 142 TR_XM_DK_SendGrid 2023 0.92 0.90 0.93 143 URI_HEX 1978 1.00 1.24 0.90 144 XM_B_Investor 1975 1.63 3.39 0.90 145 TR_Symld_Words 1962 0.94 1.04 0.90 146 XM_GoogleGroups 1870 0.80 0.67 0.86 147 XM_UB50 1838 1.60 3.42 0.84 148 XMBrknScrpt_02 1837 1.31 2.46 0.84 149 XM_B_Unsub2 1787 0.95 1.26 0.82 150 XMSubEmpty 1769 0.72 0.52 0.81 151 XMBody_95 1735 0.60 0.13 0.79 152 XMSubMetaI_00 1659 0.89 1.19 0.76 153 TVD_RCVD_IP 1615 0.83 1.07 0.74 154 MISSING_SUBJECT 1612 0.64 0.39 0.74 155 XMNoSubject 1612 0.64 0.39 0.74 156 XMSexyCombo_05 1577 1.74 4.19 0.72 157 FILL_THIS_FORM 1527 0.55 0.19 0.70 158 HTML_TAG_BALANCE_BODY 1525 0.90 1.39 0.70 159 T_OBFU_PDF_ATTACH 1471 0.51 0.11 0.67 160 XMPhish30 1452 0.96 1.68 0.66 161 RELAYCOUNTRY_AU 1437 1.11 2.21 0.66 162 URI_TRY_3LD 1363 0.67 0.78 0.62 163 XMBody_17 1357 1.27 2.84 0.62 164 DKIM_ADSP_CUSTOM_MED 1357 0.68 0.82 0.62 165 TooManyTo_003 1348 0.76 1.11 0.62 166 XM_B_DNDMA 1342 0.64 0.70 0.61 167 TR_XM_Base64_M1 1316 0.74 1.07 0.60 168 USER_IN_WELCOMELIST 1304 0.42 0.00 0.60 169 USER_IN_WHITELIST 1304 0.42 0.00 0.60 170 DIET_1 1291 1.14 2.45 0.59 171 XM_OfRef6 1285 1.08 2.28 0.59 172 T_XMHurry_00 1282 1.13 2.46 0.59 173 T_STY_INVIS_DIRECT 1205 0.81 1.43 0.55 174 GAPPY_SUBJECT 1201 0.46 0.23 0.55 175 TM2_M_OBFU_COMMENT 1190 0.56 0.60 0.54 176 XMSubMetaSxObfu_03 1175 0.66 0.95 0.54 177 FILL_THIS_FORM_LONG 1145 0.41 0.12 0.52 178 XM_B_SpammyWords4 1063 0.93 2.00 0.49 179 TR_MetaPhish_Combo_01 1059 0.51 0.56 0.48 180 TooManyTo_004 1034 0.65 1.09 0.47 181 T_FILL_THIS_FORM_SHORT 1027 0.77 1.49 0.47 182 MPART_ALT_DIFF_COUNT 1006 0.58 0.87 0.46 183 XM_H_PHPMailer 1002 0.58 0.87 0.46 184 HTML_IMAGE_ONLY_20 995 0.52 0.66 0.46 185 T_TooManySym_04 990 0.33 0.03 0.45 186 XMSubMetaD_03 982 0.55 0.79 0.45 187 XMEqualsVooDoo_00 977 0.33 0.05 0.45 188 XMSubMetaI_01 953 0.51 0.69 0.44 189 TRACKER_ID 943 0.34 0.12 0.43 190 FONT_INVIS_POSTEXTRAS 942 0.31 0.03 0.43 191 RCVD_IN_BL_SPAMCOP_NET 942 2.30 6.82 0.43 192 T_HTML_TAG_BALANCE_CENTER 933 0.39 0.30 0.43 193 XM_Walgreens_Forge 933 0.31 0.03 0.43 194 XMBSHREFv2 930 0.36 0.20 0.43 195 XMSubNoVowel 919 0.44 0.48 0.42 196 NML_ADSP_CUSTOM_MED 903 0.49 0.69 0.41 197 FORGED_GMAIL_RCVD 859 0.46 0.62 0.39 198 TooManyTo_005 855 0.59 1.07 0.39 199 HTTPS_HTTP_MISMATCH 829 0.59 1.09 0.38 200 XM_URI_RBL 825 0.94 2.28 0.38 ----------------------------------------------------------------------